Abstract

Due to the rapidly increasing connectivity and dependency over the internet by individuals and corporations to carry out their businesses, security breaches are increasing day by day. Security and privacy are becoming a greater concern for the modern world. The report of loss of critical data, cyber attacks, denial of service attacks, hacking of websites and systems etc. are becoming the headlines in news channels. In this context, log data are very useful as it is used to track the history of an intruder in day to day work and providing evidence for further investigation. Audit log data, which are produced by windows operating systems, are in binary format and are not compatible with the log format of other log sources, which makes the log management very complicated and most challenging. The windows event log stays locally in the host system and the centralization of logging process is not possible due to its distributed design. This paper outlines a brief overview of the various processes involved in the windows event logging environment and stressed to centralize the logging process. This research work implements the Winsyslog server as the central server to centralize the storage of log data and event reporter for translation of windows event log data from binary format to syslog format. The proposed architecture to centralize the storage of log data helps the system administrator in a great way by simplifying the logging process and also enhances the security to log data, which are most important for forensic investigation.